Write a working systemd unit and expand the README !18

Stacked on !17; retarget to main once that merges.

• #25 The systemd unit had Directory= (not a key), placeholder paths and a note that it was never tested. Now: WorkingDirectory, ExecStart with -c, Restart=on-failure, DynamicUser with StateDirectory=skunkyart for the cache, and the standard hardening set. Not run on a Linux host from here; please try it once.
• #27 README lists the pages and their query parameters, how to run without Docker, what REDIRECTS.md is for, a paragraph on the upstream-traffic measures, and the test and lint commands. No screenshot: I did not want to add a binary to the repo without asking.

Closes #25 Closes #27